Zero-knowledge proofs on mobile: Hekate's first benchmarks
How long a zero-knowledge proof takes on a phone: 1.34 s for a post-quantum ML-DSA (Dilithium) signature, 1.02 s for a private payment, on an iPhone 14 Pro Max.
Articles
One Tensor Commitment for Tables of Every Height
Every table of a multi-table AIR proof in one tensor commitment: one fold vector, one query set, one sumcheck, and t + 1 support cells for unsalted leaves.
One support cell short
Hekate 0.37.0 postmortem: in 0.35.0 and 0.36.0, a zero-knowledge proof could confirm a guess of its own witness. The fix costs one field element per proof.
Columns only the bus read
Hekate 0.36.0 postmortem: five soundness gaps, three with forgeries that 0.35.0 accepted, and the ordered service buses that close them.
The estimate that chose its own geometry
Hekate 0.35.0 postmortem: the security level was overstated, and 0.35.0 restates it at 100 bits that follow from published theorems. No forgery is known.
Liveness was a witness
Hekate 0.34.0 postmortem: the prover decided whether a block existed, and the same decision switched off the constraints that policed it.
Zero-Knowledge Ring-Switching without the Transpose
Ring-switching made zero-knowledge: over a binary field of degree n, the correction costs n − 1 multiplication constraints for any number of batched claims.
Shapes the honest prover never builds
Hekate 0.33.0 postmortem: seven soundness gaps across the Keccak and AES chiplets. Both computed their round functions correctly; neither proved its cipher.
Three unbound values
Hekate 0.32.0 postmortem: three soundness failures found in our own prover, two of them total breaks confirmed with a proof-of-concept prover.